How Does an SMS-Verified Captive Portal Work?

An SMS-verified captive portal redirects a user connecting to guest Wi-Fi to a login page before internet access and verifies them with a one-time code sent to their phone number. The flow is: the user connects to the network → the firewall/access device redirects them to the portal → the user enters their phone number → they verify the SMS code → if verification succeeds, internet access is opened and the session is matched to internal IP/NAT records and logged. This method practically provides the user identification that Law No. 5651 expects: the connection is tied to a verified phone number and a time, so a record can be traced to a person during a request.

This page is for information only; consult the current legislation for definitive obligations.

Step-by-step operation

1. Redirect: when the user connects, the access device redirects them to the SignLogger portal.
2. Number entry: the user enters their phone number and requests a code.
3. Code delivery: the system sends the one-time code via the defined SMS provider.
4. Verification: the user enters the code; if correct, the session opens.
5. Logging: the session is matched with internal IP (DHCP), NAT and time information and stored.

What is required for SMS?

An SMS provider (delivery service) must be defined. The portal sends the code via this provider. The method (GET/POST) and provider details are configured in the portal settings. Number verification is the link that binds the record to a person.

Can a method other than SMS be used?

Yes. Besides SMS, form/sponsor verification, Turkish ID verification or verification via a corporate directory (LDAP/Active Directory) are also possible. SMS is common in guest scenarios due to its low friction; which method fits depends on your environment.

Does it work with cloud-based access devices (e.g. Meraki)?

Yes. With an external captive portal (EXCAP) approach, on cloud-based access points the user is verified on the SignLogger portal and access is opened on the cloud side. This works even if the device is behind any firewall.

SMS captive portal in SignLogger

SignLogger offers a captive portal with form, Turkish ID, sponsor and LDAP verification alongside SMS, support for all device brands, and timestamped log retention on a single platform. The portal’s authentication is matched to NAT/DHCP records and signed and stored every day with the TÜBİTAK Kamu SM timestamp and e-signature. For the general framework see Law No. 5651 log obligation, and for which records are needed see this guide. Explore the features or request a free demo.

Frequently Asked Questions

Is the SMS code alone enough for Law No. 5651?

It provides identification but is not enough on its own; internal IP (DHCP), NAT and time records must also be kept and stored synchronized to the same clock.

How is SMS cost managed?

It depends on delivery volume; methods that don’t require SMS, such as form/sponsor, can be an alternative.

What if the user enters the number incorrectly?

The code cannot be verified and access is not opened; the user can try again.

Are foreign phone numbers supported?

It depends on the SMS provider’s coverage; a provider that supports international delivery is required.

Does the user need to log in again with the same number?

A session duration is defined per your setup; re-verification may be requested when it expires.

How long are records retained?

Common practice is at least 6 months and at most 2 years; the exact period may vary by current regulation.